Vulnerability · Published Jun 24, 2022 · Assigned by CERTVDE

CVE-2022-31803CODESYS Gateway Server V2 prone to Denial of Service Attack

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in CODESYS Gateway Server V2 from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.2%top 32.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connections are not affected and therefore remain intact.

Affected products (as reported)

Vendor	Product	Versions
CODESYS	CODESYS Gateway Server V2	V2 – before V2.3.9.38

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17141&token=17867e35cfd30c77ba0137f9a17b3a557a4b7b66&download= x_refsource_CONFIRM